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19 July 1979 


MEMORANDUM FOR: Deputy Director for National Foreign Assessment 
Deputy Director for Operations 
Deputy Director for Science and Technology 
Inspector General 
General Counsel 
Legislative Counsel 
Comptroller 


tef, Regulations Control Division 


Information Services Staff 
SUBJECT: ec Ce a Data Access and Release 
D ob #8902) 
FOR YOUR CONCURRENCE OR COMMENTS: 


1. The attached proposal, initiated by the Office of Security, 
replaces several existing regulations (see instruction sheet). The 


regulation is part of a package to implement safeguarding provisions 
of Executive Order 12065. The package consists of tin print; 


-Draft B in coordination; and [si Dra t A in coordination. 


2. Please forward your_concurrence or comments by 9 August 1979. 
Questions may be directed to ery 


*New Numbering Series 


Attachments: 
ss Ac 
2. Concurrence shee 
cc: AOQ/DCI 
AO/RMS-CTS 
SSA/DDA 
C/1SS 
C/RMD 
Os 
Oc 
OL 
OP 
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SECURITY STA 


*23. STORAGE OF CLASSIFIED INFORMATION OR MATERIAL 


‘SYNOPSIS. This regulation prescribes the policies, authority, and responsibilities 
associated with the storage of classified information or material within the United 
States. 


a. AUTHORITY. Policies promulgated in this regulation are established in accordance with the 
requirements of Section 4-103 of Executive Order 12065, National Security 
Information, and Section IV.F of the Information Security Oversight Office Directive 
No. 1, effective 1 December 1978. 


b. GENERAL. Classified information or material in the custody of the Agency will be stored 
only in facilities or under conditions that will provide adequate protection and prevent 
access by unauthorized persons. Classified information or material disseminated outside the 
executive branch shall be given protection comparable to that afforded within the executive 
branch pursuant to such conditions as the Director of Security may prescribe. 


c. RESPONSIBILITIES 


(1) EMPLOYEES, Individual employees are responsible for securing classified information 
or material in their possession in designated equipment and areas when not being 
maintained under immediate personal control in approved work areas. 


DIRECTOR OF SECURITY. The Director of Security is responsible for establishing 
standards in accordance with the requirements of the Information Security Oversight 
Office Directive No. 1, effective 1 December 1978, for the proper storage of classified 
information or material. These include approved criteria for vault and vault-type room 
construction and for the acceptability of safes, safekeeping devices, and other classified 
storage equipment. 


DIRECTOR OF LOGISTICS. The Director of Logistics will ensure that all requests for 
the construction of vaults and vault-type rooms and for the purchase, lease, or issue of 
safekeeping storage equipment are approved by the Director of Security and bear the 
concurrence of the Agency Records Management Officer. The latter must certify the 
records management justification for the request. 


(2 


(3 


d. STORAGE REQUIREMENTS 


(1) GENERAL. Specifications for approved vaults and vault-type rooms are available from 
the Office of Security. If the bulk or volume of classified material presents a storage 
problem and it is not possible to comply with the provisions of paragraph d(2) or d(3) 
below, the Director of Security must be consulted for guidance. Any exceptions to the 
following storage requirements must have the prior approval of the Director of Security. 

(2) AGENCY BUILDINGS IN HEADQUARTERS AREA. In Agency buildings in the 
headquarters area (including the Agency Training Centers), information and material 
classified Confidential, Secret, or Top Secret may be stored in any GSA-approved safe- 
type steel file cabinet or in an approved vault or vault-type room. 
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SECURITY 


COMBINATIONS. Safekeeping equipment combinations are classified Top Secret. They are 
not to be carried on the person, recorded in any insecure manner, or disclosed over the black 
or red telephone. Supervisors will limit distribution of combinations to the number of persons 
(custodians) necessary for operating purposes. Supervisors will also ensure that combinations 
to safekeeping equipment used for the storage of sensitive compartmented information, 
cryptographic materials, and Restricted Data are given only to individuals holding the 
commensurate access approvals or clearances associated with such information or material. 


(1) COMBINATION CHANGES. The Office of Security is responsible for changing 
combinations to all Agency safekeeping equipment in the headquarters area. Newly 
received safekeeping equipment will not be used until a representative of the Office of 
Security has reset the combination. Thereafter, the Office of Security will arrange for 
changing combinations at least once every year and when otherwise required. Operating 
Officials will ensure that combinations to safekeeping equipment are changed (a) upon 
separation or transfer of a custodian, (b) when a custodian no longer needs access to the 
information or material therein, (c) whenever a combination has been subjected to 
possible compromise, and (d) whenever the equipment is taken out of service. 


(2) COMBINATION RECORDS. The Office of Security maintains a central record of the 
combinations to and custodians of all Agency safekeeping equipment in the headquarters 
area. 


. USE AND CARE OF SAFEKEEPING EQUIPMENT. Custodians will follow procedures 


which ensure that unauthorized persons do not gain access to classified information or 
material. Custodians must know the proper method of locking and checking all safekeeping 
equipment to which they have access. They will report immediately to the Office of Security 
the improper working order of safekeeping equipment under their care. The Office of 
Security will promptly correct mechanical defects in such equipment. 


. TRANSFER OF SAFEKEEPING EQUIPMENT 


(1) Before safekeeping equipment is transferred out of an office, the principal custodian and 
the appropriate supervisor will ensure that the equipment is empty of all information or 
material, including any posted record of custodians, and, in the headquarters area, will 
contact the Office of Security to request that the equipment be processed for transfer. 


(2) Before any furniture or equipment (including desks, tables, file cabinets, shelving, etc.) 
that was used to store classified information or material within vaults or vault-type rooms 
is transferred out of an office, the principal custodian and the appropriate supervisor will 
check the furniture and equipment to ensure that it does not contain any classified 
information or material. This will include a check to ensure that no classified information 
or material has fallen under or behind the drawers of such furniture and equipment. 
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